cruciferra[.]com

This domain, cruciferra.com, is actively flagged as a high-risk phishing infrastructure specializing in red-team tool distribution. Registered on October 2, 2025, through NiceNIC International Group Co., Limited, the domain resolves to IP address 172.67.69.29 and is protected by Cloudflare, which obscures direct server attribution. The page title, 'Cruciferra — The World's Most Advanced Red Team Protection. Bypass Every Antivirus,' explicitly advertises offensive security tools, a common tactic used to lure security professionals and malicious actors alike. Analysis indicates the domain is currently operational, with no signs of takedown or deactivation as of July 12, 2026. Infrastructure review reveals the domain is listed on two security blocklists and appears in 25 threat intelligence pulses on a major open-source threat exchange platform, suggesting persistent malicious activity. Fourteen of 95 security vendors in a recent scan flagged the domain, reinforcing its classification as a confirmed threat. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to its widespread use across both benign and malicious sites. The domain's creation date, while recent, falls within expected parameters for newly established phishing or tool distribution operations. Defenders should treat this domain as an active threat vector. The advertised functionality—bypassing antivirus protections—aligns with known phishing toolkits designed to evade detection, though the exact payload or delivery mechanism remains unconfirmed. Network-level blocking is recommended for organizations, particularly those in cybersecurity or IT sectors, as the domain's content directly targets security practitioners. Further analysis of associated files or redirects may be necessary to determine the full scope of its capabilities.